PHP Vulnerability Responses by Company

WPEngine, Inc.

Global hosting
Aliases / services
WP Engine / wpengine.com / WPEngine, Inc.
Official website
https://wpengine.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Managed WordPress

Response status
Patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October 22 notice confirms patches for both CVEs on all customer sites.

Scope: Applies to WP Engine-managed sites.

What users should do

No customer patch action is required; contact support for environment-specific confirmation.

Official service URL

Source URLs

  1. https://wpengine.com/blog/php-vulnerability-update/https://wpengine.com/blog/php-vulnerability-update/Response evidence

Flywheel Managed WordPress

Response status
Patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October 21 update confirms PHP patch deployment completed on Flywheel.

Scope: The separate October 23 CVE-2026-115560 notice describes protection by existing mitigations.

What users should do

No customer patch action is required; contact Flywheel support if needed.

Source URLs

  1. https://status.getflywheel.com/2026/10/21/php-security-update/https://status.getflywheel.com/2026/10/21/php-security-update/Response evidence
Related official sources
  1. WP Engine: PHP configuration and managementOfficial information directoryPHP operations documentation; incident patch deployment unconfirmed.

Comments